Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Feature/default risk audit #311

Merged
merged 8 commits into from
Jun 4, 2024
Merged

Feature/default risk audit #311

merged 8 commits into from
Jun 4, 2024

Conversation

prabhu
Copy link
Member

@prabhu prabhu commented Jun 4, 2024 •
edited
Loading

Risk audit is automatically performed for purl based searches.

Support for malicious packages

malicious

Donation panel is now prominently shown in CI (example below). To remove the banner, make a donation to OWASP (or at least tweet about dep-scan) and invoke the cli with the argument --no-banner.

CI=true python depscan/cli.py --purl "pkg:pypi/requests@2.32.1"
╭─────────────────────────────── Donate to the OWASP Foundation ────────────────────────────────╮
│ OWASP foundation relies on donations to fund our projects.                                    │
│ Please donate at: https://owasp.org/donate/?reponame=www-project-dep-scan&title=OWASP+depscan │
╰───────────────────────────────────────────────────────────────────────────────────────────────╯

██████╗ ███████╗██████╗ ███████╗ ██████╗ █████╗ ███╗   ██╗
██╔══██╗██╔════╝██╔══██╗██╔════╝██╔════╝██╔══██╗████╗  ██║
██║  ██║█████╗  ██████╔╝███████╗██║     ███████║██╔██╗ ██║
██║  ██║██╔══╝  ██╔═══╝ ╚════██║██║     ██╔══██║██║╚██╗██║
██████╔╝███████╗██║     ███████║╚██████╗██║  ██║██║ ╚████║
╚═════╝ ╚══════╝╚═╝     ╚══════╝ ╚═════╝╚═╝  ╚═╝╚═╝  ╚═══╝

@prabhu
Automatically enable risk audit for single package searches
e7e2e9d 
Signed-off-by: Prabhu Subramanian <prabhu@appthreat.com>
@prabhu
Automatically enable risk audit for single package searches
15c68a5 
Signed-off-by: Prabhu Subramanian <prabhu@appthreat.com>
@prabhu
Bump vdb version
a5ce2f7 
Signed-off-by: Prabhu Subramanian <prabhu@appthreat.com>
@prabhu
Update container packages
06cae6c 
Signed-off-by: Prabhu Subramanian <prabhu@appthreat.com>
@prabhu
Update readme
a720131 
Signed-off-by: Prabhu Subramanian <prabhu@appthreat.com>
@prabhu
Show donation panel in CI
e2bb884 
Signed-off-by: Prabhu Subramanian <prabhu@appthreat.com>
@prabhu
Show donation panel in CI
69dbdab 
Signed-off-by: Prabhu Subramanian <prabhu@appthreat.com>
@prabhu
Malicious packages
3b7eca4 
Signed-off-by: Prabhu Subramanian <prabhu@appthreat.com>
@prabhu prabhu merged commit 75810e1 into release/5.x Jun 4, 2024
78 checks passed
@prabhu prabhu deleted the feature/default-risk-audit branch June 4, 2024 21:01
prabhu
prabhu commented Jun 11, 2024
View reviewed changes
depscan/lib/pkg_query.py

# Check for the maximum seconds difference between latest version and now
if latest_now_diff.total_seconds() > config.latest_now_max_seconds:
print(latest_now_diff.total_seconds(), config.latest_now_max_seconds)
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This needs to be removed.

@prabhu prabhu mentioned this pull request Jun 11, 2024
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@prabhu